If you discover a security issue with REDAXO or a related package, please
contact us via https://github.com/redaxo/core/security/advisories/new or
info {at} redaxo.org instead of using a public channel. That way we can work
on a fix together before everyone knows how to exploit a potential issue. Thank
you!
Repository navigation
Security: redaxo/core
Security
SECURITY.md
-
Package API does not check for admin permissionGHSA-fw98-549m-whxx published
Oct 6, 2026 by gharlanModerate -
Password change does not invalidate the current session and its stay-logged-in keyGHSA-mjjv-vffq-g5h6 published
Oct 6, 2026 by gharlanLow -
Missing CSRF protection on the safe mode toggle allows changing the global safe mode settingGHSA-423v-8x3h-gxr3 published
Oct 6, 2026 by gharlanModerate -
Non-admin users with backup export permission can export authentication tablesGHSA-phjc-vx3j-58r3 published
Oct 6, 2026 by gharlanHigh -
Working version and history previews do not verify permissions for the previewed articleGHSA-v4m9-jvvr-83cx published
Aug 3, 2026 by gharlanHigh -
Media pool bulk move does not verify permission for the source categoryGHSA-j9mx-x52f-48cw published
Aug 3, 2026 by gharlanHigh -
Slice operations do not verify that the slice belongs to the permission checked articleGHSA-5m63-c3qx-wq8v published
Aug 3, 2026 by gharlanHigh -
Stored cross-site scripting (XSS) in the media and link input widgetsGHSA-5wmj-5x79-rr87 published
Aug 3, 2026 by gharlanModerate -
Authentication bypass via forgeable temporary login token in the history pluginGHSA-px8f-whj8-hrpq published
Aug 3, 2026 by gharlanCritical -
Mediapool: unsanitized SVG uploads are publicly reachable, enabling stored XSSGHSA-2p3g-jr7p-qwwx published
Aug 3, 2026 by gharlanModerate
Learn more about advisories related to redaxo/core in the GitHub Advisory Database